@remnic/core 9.69.38 → 9.69.40

package/src/activity/timeline/analysis-run.test.ts

@@ -417,3 +417,85 @@ test("adapter pins the call-time provider verbatim with no chain fallback", asyn
   });
   assert.deepEqual(seen, ["anthropic/claude-4_1"]);
 });
+
+test("remote failureDiag preserves a rate-limited failure as retryable (issue #2891)", async () => {
+  const cards = sampleCards();
+  const remoteLlm: TimelineAnalysisRemoteLlm = {
+    chatCompletion: async (_messages, options) => {
+      assert.ok(options.failureDiag, "adapter must pass a failureDiag out-box");
+      options.failureDiag.lastError = Object.assign(new Error("provider throttled"), { status: 429 });
+      return null;
+    },
+  };
+  const result = await runTimelineCardAnalysis({
+    date: DATE,
+    timezone: TZ,
+    cards,
+    observations: [observation()],
+    config: ENABLED,
+    deps: { remoteLlm },
+  });
+  assert.equal(result.status, "provider_failed");
+  assert.equal(result.failure?.kind, "rate_limited");
+  assert.equal(result.failure?.retryable, true);
+  assert.equal(result.failure?.preservesDeterministic, true);
+  assert.equal(result.cards, cards);
+});
+
+test("local failureDiag preserves a rate-limited failure (issue #2891)", async () => {
+  const localLlm: TimelineAnalysisLocalLlm = {
+    chatCompletion: async (_messages, options) => {
+      assert.ok(options.failureDiag, "adapter must pass a failureDiag out-box");
+      options.failureDiag.lastError = Object.assign(new Error("local backend throttled"), { status: 429 });
+      return null;
+    },
+  };
+  const result = await runTimelineCardAnalysis({
+    date: DATE,
+    timezone: TZ,
+    cards: sampleCards(),
+    observations: [observation()],
+    config: { enabled: true, provider: "local", model: "local-test" },
+    deps: { localLlm },
+  });
+  assert.equal(result.status, "provider_failed");
+  assert.equal(result.failure?.kind, "rate_limited");
+  assert.equal(result.failure?.retryable, true);
+});
+
+test("failureDiag without a rate limit still classifies as provider_unavailable", async () => {
+  const remoteLlm: TimelineAnalysisRemoteLlm = {
+    chatCompletion: async (_messages, options) => {
+      options.failureDiag!.lastError = Object.assign(new Error("server error"), { status: 500 });
+      return null;
+    },
+  };
+  const result = await runTimelineCardAnalysis({
+    date: DATE,
+    timezone: TZ,
+    cards: sampleCards(),
+    observations: [observation()],
+    config: ENABLED,
+    deps: { remoteLlm },
+  });
+  assert.equal(result.status, "provider_failed");
+  assert.equal(result.failure?.kind, "provider_unavailable");
+  assert.equal(result.failure?.retryable, true);
+});
+
+test("a null completion with no recorded cause keeps the generic kind", async () => {
+  const remoteLlm: TimelineAnalysisRemoteLlm = {
+    chatCompletion: async () => null,
+  };
+  const result = await runTimelineCardAnalysis({
+    date: DATE,
+    timezone: TZ,
+    cards: sampleCards(),
+    observations: [observation()],
+    config: ENABLED,
+    deps: { remoteLlm },
+  });
+  assert.equal(result.status, "provider_failed");
+  assert.equal(result.failure?.kind, "provider_unavailable");
+  assert.equal(result.failure?.retryable, true);
+});

package/src/activity/timeline/publish-cli.test.ts

@@ -167,3 +167,33 @@ test("range and search reject publish-only flags instead of ignoring them", asyn
   assert.equal(searchCode, 1);
   assert.match(searchSink.err, /unknown flag --dry-run \(valid: --from, --limit, --query, --to\)/);
 });
+
+test("an explicitly empty --date is invalid, not treated as absent (#2917)", async () => {
+  const { config, notePath, note } = makeFixture();
+  const sink = capture();
+
+  const code = await runTimelineCliCommand(
+    { cards: null, qa: { enabled: false, maxRangeDays: 31 }, timelineEnabled: true, config },
+    ["publish", "--date", ""],
+    sink.io,
+  );
+
+  assert.equal(code, 1);
+  assert.match(sink.err, /Invalid --date ""/);
+  assert.equal(readFileSync(notePath, "utf8"), note, "no note is published on an empty --date");
+});
+
+test("publish rejects extra positional arguments instead of discarding them (#2917)", async () => {
+  const { config, notePath, note } = makeFixture();
+  const sink = capture();
+
+  const code = await runTimelineCliCommand(
+    { cards: null, qa: { enabled: false, maxRangeDays: 31 }, timelineEnabled: true, config },
+    ["publish", "extra-arg", "--date", DATE],
+    sink.io,
+  );
+
+  assert.equal(code, 1);
+  assert.match(sink.err, /takes no positional arguments/);
+  assert.equal(readFileSync(notePath, "utf8"), note, "no note is published on excess syntax");
+});

package/src/activity/timeline/publish-cli.ts

@@ -51,6 +51,13 @@ export function runTimelinePublishCli(
     return 1;
   }
 
+  // An explicitly empty --date is invalid, not absent (issue #2917): ""
+  // can never be a day, and silently falling back to today would publish
+  // the wrong note. Only a missing --date means "today".
+  if (options.date !== undefined && (typeof options.date !== "string" || options.date.length === 0)) {
+    io.stderr.write(`Invalid --date ${JSON.stringify(options.date ?? "")}; expected YYYY-MM-DD.\n`);
+    return 1;
+  }
   // Timeline artifacts are grouped on the configured activity timezone's
   // calendar day, so "today" must be derived there — the host-local day
   // drifts by one near either timezone's midnight.

package/src/activity/timeline/query.ts

@@ -311,7 +311,14 @@ export async function runTimelineCliCommand(
         io.stderr.write("timeline publish requires the Remnic config — run `remnic doctor`\n");
         return 1;
       }
-      const publishFlags = parseFlags(rest, PUBLISH_FLAGS).flags;
+      const { flags: publishFlags, positional } = parseFlags(rest, PUBLISH_FLAGS);
+      // `publish` takes flags only (issue #2917): a stray positional used
+      // to be silently discarded while today's note published.
+      if (positional.length > 0) {
+        throw new TypeError(
+          `timeline publish takes no positional arguments (got ${JSON.stringify(positional.join(" "))})`,
+        );
+      }
       return runTimelinePublishCli(
         deps.config,
         {

package/src/activity/timeline/regenerate.test.ts

@@ -114,7 +114,6 @@ function priorEditsFromPrompt(prompt: string): unknown {
   return parsed.priorEdits;
 }
 
-
 test("disabled analysis persists deterministic cards and makes zero provider calls", async () => {
   await withStore(async (store, memoryDir) => {
     store.insertSnapshot(snapshot());
@@ -413,6 +412,88 @@ test("listPersistedTimelineDates lists only valid day files", async () => {
   }
 });
 
+test("a timezone change invalidates the cached day and re-analyzes (issue #2891)", async () => {
+  await withStore(async (store, memoryDir) => {
+    store.insertSnapshot(snapshot());
+    const remote = fakeRemote(async () => ({ content: '{"ops":[]}' }));
+    const analysis = parseActivityConfig({
+      timeline: { analysis: { enabled: true, provider: "openai", model: "gpt-test" } },
+    }).timeline.analysis;
+    const first = await regenerateTimelineDay({
+      date: DATE,
+      timezone: TZ,
+      memoryDir,
+      store,
+      timelineEnabled: true,
+      analysis,
+      deps: { remoteLlm: remote.remoteLlm },
+    });
+    assert.equal(first.status, "ok");
+    assert.equal(remote.calls, 1);
+    const sameTz = await regenerateTimelineDay({
+      date: DATE,
+      timezone: TZ,
+      memoryDir,
+      store,
+      timelineEnabled: true,
+      analysis,
+      deps: { remoteLlm: remote.remoteLlm },
+    });
+    assert.equal(sameTz.written, false);
+    assert.equal(remote.calls, 1);
+    const shifted = await regenerateTimelineDay({
+      date: DATE,
+      timezone: "America/New_York",
+      memoryDir,
+      store,
+      timelineEnabled: true,
+      analysis,
+      deps: { remoteLlm: remote.remoteLlm },
+    });
+    assert.equal(shifted.status, "ok");
+    assert.equal(shifted.written, true);
+    assert.equal(shifted.analyzed, true);
+    assert.equal(remote.calls, 2);
+    const persisted = JSON.parse(await readFile(timelineDayPath(memoryDir, DATE), "utf8"));
+    assert.equal(persisted.timezone, "America/New_York");
+  });
+});
+
+test("an empty day cached under one timezone is rebuilt under another (issue #2891)", async () => {
+  await withStore(async (store, memoryDir) => {
+    const remote = fakeRemote(async () => ({ content: '{"ops":[]}' }));
+    const analysis = parseActivityConfig({
+      timeline: { analysis: { enabled: true, provider: "openai", model: "gpt-test" } },
+    }).timeline.analysis;
+    const first = await regenerateTimelineDay({
+      date: DATE,
+      timezone: TZ,
+      memoryDir,
+      store,
+      timelineEnabled: true,
+      analysis,
+      deps: { remoteLlm: remote.remoteLlm },
+    });
+    assert.equal(first.status, "invalid_output");
+    assert.equal(first.analyzed, false);
+    assert.equal(remote.calls, 0);
+    const shifted = await regenerateTimelineDay({
+      date: DATE,
+      timezone: "America/New_York",
+      memoryDir,
+      store,
+      timelineEnabled: true,
+      analysis,
+      deps: { remoteLlm: remote.remoteLlm },
+    });
+    // Zero observations under any timezone: still a rebuild, never the
+    // UTC-cached file served with the old day derivation.
+    assert.equal(shifted.written, true);
+    const persisted = JSON.parse(await readFile(timelineDayPath(memoryDir, DATE), "utf8"));
+    assert.equal(persisted.timezone, "America/New_York");
+  });
+});
+
 test("a correction for another day does not change this day's hash, cache, or provider input", async () => {
   await withStore(async (store, memoryDir) => {
     store.insertSnapshot(snapshot());
@@ -502,4 +583,3 @@ test("a same-day correction updates hash, cards, and priorEdits", async () => {
     assert.notEqual(persistedSourceHash(await readFile(timelineDayPath(memoryDir, DATE), "utf8")), firstHash);
   });
 });
-

package/src/activity/timeline/regenerate.ts

@@ -191,12 +191,18 @@ function resolveClients(input: RegenerateTimelineDayInput): TimelineAnalysisClie
 }
 
 function sourceHash(input: {
+  timezone: string;
   observations: readonly TimelineObservation[];
   analysis: ActivityTimelineAnalysisConfig;
   corrections: readonly TimelineCorrection[];
 }): string {
   return hashActivityBody(
     JSON.stringify({
+      // The timezone is a day-window determinant (it bounds which
+      // observations the day sees), so it belongs to the source identity:
+      // identical observations under a different timezone must not reuse
+      // the cached day (issue #2891).
+      timezone: input.timezone,
       observations: input.observations.map((observation) => ({
         id: observation.id,
         contentHash: observation.contentHash,
@@ -310,7 +316,7 @@ async function regenerateUncached(input: RegenerateTimelineDayInput): Promise<Re
     const rawCards = buildTimelineDay({ date, timezone, observations }).cards;
     corrections = correctionsForCards(rawCards, corrections);
     const built = applyTimelineCorrections(rawCards, corrections);
-    const hash = sourceHash({ observations, analysis: input.analysis, corrections });
+    const hash = sourceHash({ timezone, observations, analysis: input.analysis, corrections });
     const prior = readPersisted(filePath);
     if (prior !== null && prior.sourceHash === hash && isCachedDayFinal(prior.status, input.analysis.enabled)) {
       return toResult(filePath, false, false, prior);

package/src/activity/vault-frontmatter.test.ts

@@ -1,7 +1,14 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { applyVaultFrontmatter } from "./vault-frontmatter.js";
+import {
+  applyVaultFrontmatter,
+  renderVaultPropertyValue,
+  validateVaultProperties,
+  VAULT_PROPERTY_LIST_MAX_ITEMS,
+  VAULT_PROPERTY_SCALAR_MAX_CHARS,
+  VAULT_PROPERTY_TOTAL_MAX_CHARS,
+} from "./vault-frontmatter.js";
 
 test("applyVaultFrontmatter merges listed keys and sorts", () => {
   const merged = applyVaultFrontmatter("zeta: old\nalpha: keep\n", {
@@ -26,3 +33,94 @@ test("applyVaultFrontmatter leaves the original body unchanged when updates are
   const existing = "zeta: 1\n# comment stays\nalpha: 2\n";
   assert.equal(applyVaultFrontmatter(existing, {}), existing);
 });
+
+test("accepts a plain scalar and renders it verbatim (#2917)", () => {
+  assert.deepEqual(validateVaultProperties([{ key: "remnic_focus", value: "220" }]), { ok: true });
+  assert.equal(renderVaultPropertyValue("220"), "220");
+});
+
+test("accepts a list of plain scalars and renders a flow list (#2917)", () => {
+  assert.deepEqual(validateVaultProperties([{ key: "remnic_cards", value: ["a", "b"] }]), { ok: true });
+  assert.equal(renderVaultPropertyValue(["a", "b"]), "[a, b]");
+});
+
+test("rejects newline and control characters — the injection primitives (#2917)", () => {
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: "v\ninjected: yes" }]).ok, false);
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: "v\rinjected: yes" }]).ok, false);
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: "v\ttab" }]).ok, false);
+});
+
+test("rejects values whose YAML shape would change on re-read (#2917)", () => {
+  for (const value of [" padded", "padded ", "[seq]", "{map}", "#comment", "- item", "a #c", "ends:", "a: b"]) {
+    assert.equal(
+      validateVaultProperties([{ key: "remnic_x", value }]).ok,
+      false,
+      `value ${JSON.stringify(value)} must be rejected`,
+    );
+  }
+});
+
+test("a negative number stays a plain scalar (#2917)", () => {
+  assert.deepEqual(validateVaultProperties([{ key: "remnic_delta", value: "-5" }]), { ok: true });
+});
+
+test("rejects unsupported value shapes (#2917)", () => {
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: 42 as unknown as string }]).ok, false);
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: null as unknown as string }]).ok, false);
+  assert.equal(
+    validateVaultProperties([{ key: "remnic_x", value: { nested: true } as unknown as string }]).ok,
+    false,
+  );
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: [] as unknown as string[] }]).ok, false);
+});
+
+test("rejects oversize scalars, lists, keys, and totals (#2917)", () => {
+  assert.equal(
+    validateVaultProperties([{ key: "remnic_x", value: "v".repeat(VAULT_PROPERTY_SCALAR_MAX_CHARS + 1) }]).ok,
+    false,
+  );
+  assert.equal(validateVaultProperties([{ key: "x".repeat(65), value: "v" }]).ok, false);
+  const tooMany = Array.from({ length: VAULT_PROPERTY_LIST_MAX_ITEMS + 1 }, (_, i) => `item-${i}`);
+  assert.equal(validateVaultProperties([{ key: "remnic_x", value: tooMany }]).ok, false);
+  const entries = Array.from({ length: 30 }, (_, i) => ({
+    key: `remnic_k${i}`,
+    value: "v".repeat(100),
+  }));
+  assert.equal(
+    validateVaultProperties(entries).ok,
+    false,
+    `30 × 100+ chars must exceed the ${VAULT_PROPERTY_TOTAL_MAX_CHARS}-char total`,
+  );
+});
+
+test("rejects malformed keys (#2917)", () => {
+  assert.equal(validateVaultProperties([{ key: "remnic x:", value: "v" }]).ok, false);
+  assert.equal(validateVaultProperties([{ key: " padded", value: "v" }]).ok, false);
+  assert.equal(validateVaultProperties([{ key: "remnic#x", value: "v" }]).ok, false);
+  assert.equal(validateVaultProperties([{ key: "", value: "v" }]).ok, false);
+});
+
+test("rejects a final key that starts with a YAML indicator (#2917)", () => {
+  // Prefix "[" + key "focus" is the review case: the written line would
+  // be `[focus: 220`, which is not a mapping entry.
+  for (const key of ["[focus", "{focus", "*focus", "&focus", "!focus", "%focus"]) {
+    assert.equal(
+      validateVaultProperties([{ key, value: "220" }]).ok,
+      false,
+      `key ${JSON.stringify(key)} must be rejected`,
+    );
+  }
+  assert.deepEqual(validateVaultProperties([{ key: "remnic_focus", value: "220" }]), { ok: true });
+  assert.deepEqual(validateVaultProperties([{ key: "x_focus", value: "220" }]), { ok: true });
+});
+
+test("rejects flow delimiters inside list scalar items (#2917)", () => {
+  for (const item of ["a{", "a}", "a[", "a]", "a,b"]) {
+    assert.equal(
+      validateVaultProperties([{ key: "remnic_cards", value: [item] }]).ok,
+      false,
+      `list item ${JSON.stringify(item)} must be rejected`,
+    );
+  }
+  assert.deepEqual(validateVaultProperties([{ key: "remnic_cards", value: ["a", "b"] }]), { ok: true });
+});

package/src/activity/vault-frontmatter.ts

@@ -37,3 +37,134 @@ export function applyVaultFrontmatter(
     .map((key) => `${key}: ${merged.get(key)}`)
     .join("\n");
 }
+
+/**
+ * Frontmatter property boundary for the vault publisher (issue #2917).
+ *
+ * Property values written into note frontmatter must be single-line
+ * plain YAML scalars (or lists of them) whose rendered `key: value` line
+ * cannot change shape or inject keys when a YAML parser reads the note
+ * back. Validation is pure and total; the publisher runs it before any
+ * note byte is read or written, so a rejection can never leave a
+ * half-merged note behind.
+ */
+
+/** A supported property value: one plain scalar, or a list of them. */
+export type VaultPropertyValue = string | readonly string[];
+
+export const VAULT_PROPERTY_KEY_MAX_CHARS = 64;
+export const VAULT_PROPERTY_SCALAR_MAX_CHARS = 200;
+export const VAULT_PROPERTY_LIST_MAX_ITEMS = 20;
+export const VAULT_PROPERTY_TOTAL_MAX_CHARS = 2_000;
+
+// C0 controls, DEL, and C1 controls. Covers \n, \r, \t — a newline is the
+// frontmatter-injection primitive (`v\ninjected: yes` becomes a new key).
+const CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/;
+// Characters that make the first character a YAML indicator. `-`, `?`,
+// and `:` only indicate when followed by a space, so `-5` stays a plain
+// scalar while `- 5` does not.
+const INDICATOR_CHARS = ",[]{}#&*!|>'\"%@`";
+const INJECTION_RE = /: | #/;
+// Flow-collection delimiters. Lists render as `[a, b]`; a bare delimiter
+// inside an item splits or closes the sequence on re-read.
+const FLOW_ITEM_DELIM_RE = /[[\]{},]/;
+
+export type ValidateVaultPropertyResult = { ok: true } | { ok: false; reason: string };
+
+/** Render a validated value the way `mergeFrontmatterKeys` writes it. */
+export function renderVaultPropertyValue(value: VaultPropertyValue): string {
+  return typeof value === "string" ? value : `[${value.join(", ")}]`;
+}
+
+function hasLeadingYamlIndicator(text: string): boolean {
+  const first = text[0];
+  if (first === undefined) return false;
+  return INDICATOR_CHARS.includes(first) || ("-?:".includes(first) && text[1] === " ");
+}
+
+function validateScalar(value: string, label: string): ValidateVaultPropertyResult {
+  if (value.length === 0) {
+    return { ok: false, reason: `${label} must not be empty` };
+  }
+  if (value.length > VAULT_PROPERTY_SCALAR_MAX_CHARS) {
+    return { ok: false, reason: `${label} exceeds ${VAULT_PROPERTY_SCALAR_MAX_CHARS} characters` };
+  }
+  if (CONTROL_RE.test(value)) {
+    return { ok: false, reason: `${label} must not contain control characters or line breaks` };
+  }
+  if (value !== value.trim()) {
+    return { ok: false, reason: `${label} must not carry leading or trailing whitespace` };
+  }
+  if (hasLeadingYamlIndicator(value)) {
+    return { ok: false, reason: `${label} must be a plain scalar (leading "${value[0]}" changes its YAML shape)` };
+  }
+  if (INJECTION_RE.test(value)) {
+    return { ok: false, reason: `${label} must not contain ": " or " #"` };
+  }
+  if (value.endsWith(":")) {
+    return { ok: false, reason: `${label} must not end with ":"` };
+  }
+  return { ok: true };
+}
+
+/**
+ * Validate the final (already-prefixed) property set a publish would
+ * write: key shape, per-value scalar/list shape, per-value bounds, and
+ * the total rendered size across every entry.
+ */
+export function validateVaultProperties(
+  entries: ReadonlyArray<{ key: string; value: VaultPropertyValue }>,
+): ValidateVaultPropertyResult {
+  let total = 0;
+  for (const { key, value } of entries) {
+    if (key.length === 0) {
+      return { ok: false, reason: "property keys must not be empty" };
+    }
+    if (key.length > VAULT_PROPERTY_KEY_MAX_CHARS) {
+      return { ok: false, reason: `property key exceeds ${VAULT_PROPERTY_KEY_MAX_CHARS} characters` };
+    }
+    if (
+      CONTROL_RE.test(key) ||
+      key !== key.trim() ||
+      key.includes(":") ||
+      key.includes("#") ||
+      hasLeadingYamlIndicator(key)
+    ) {
+      return { ok: false, reason: `property key ${JSON.stringify(key)} is not a plain mapping key` };
+    }
+    if (typeof value === "string") {
+      const scalar = validateScalar(value, `property ${key}`);
+      if (!scalar.ok) return scalar;
+    } else {
+      if (!Array.isArray(value) || value.length === 0) {
+        return { ok: false, reason: `property ${key} must be a scalar string or a non-empty list of scalar strings` };
+      }
+      if (value.length > VAULT_PROPERTY_LIST_MAX_ITEMS) {
+        return { ok: false, reason: `property ${key} exceeds ${VAULT_PROPERTY_LIST_MAX_ITEMS} list items` };
+      }
+      for (const item of value) {
+        if (typeof item !== "string") {
+          return { ok: false, reason: `property ${key} must be a scalar string or a list of scalar strings` };
+        }
+        const scalar = validateScalar(item, `property ${key} list item`);
+        if (!scalar.ok) return scalar;
+        // Lists render in flow form `[a, b]`; a bare delimiter inside an
+        // item would split or close the sequence on re-read.
+        if (FLOW_ITEM_DELIM_RE.test(item)) {
+          return {
+            ok: false,
+            reason: `property ${key} list item must not contain flow delimiters "[", "]", "{", "}", or ","`,
+          };
+        }
+      }
+    }
+    total += key.length + 2 + renderVaultPropertyValue(value).length;
+    if (total > VAULT_PROPERTY_TOTAL_MAX_CHARS) {
+      return {
+        ok: false,
+        reason: `frontmatter properties exceed the ${VAULT_PROPERTY_TOTAL_MAX_CHARS}-character total`,
+      };
+    }
+  }
+  return { ok: true };
+}

package/src/activity/vault-publish.ts

@@ -261,6 +261,12 @@ export function parseAtxHeading(line: string): { level: number; text: string } |
   return { level, text: line.slice(start, end) };
 }
 
+/** True when `## ${name}` parses back to the same heading text. */
+export function headingSurvivesRoundTrip(name: string): boolean {
+  const parsed = parseAtxHeading(`## ${name}`);
+  return parsed !== null && parsed.text === name;
+}
+
 export function publishVaultRegion(input: {
   vaultPath: string;
   relativeFile: string;